BSOD left home with computer on, error 0x000000F4

[Flattyraccoon]

Hi there, I left my computer on while going to work and when I came back discovered that it had gone into the BSOD. Recently I have been getting a "Device driver has stopped working" notification when coming out of sleep. After restarting everything is working and it sometimes takes a few sleep wake cycles before I get the device failure message. I am attaching a picture of the failed driver and the crash dump folder from the diagnostic tool. Any help would be greatly appreciated thank you!

 

[JMV2009]

So windows rebooted because an essential windows service had crashed. Please test your memory with memtest86 and memtest from hcidesign.com. Please stress-test your system.

 

[Arc]

Well, first of all you uninstall Acronis Try&Decide and Restore Points Volume Filter Driver (also included in Seagate DiscWizard).

fffff880`02c126a8  fffff880`01d622b2Unable to load image \SystemRoot\system32\DRIVERS\tdrpman.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tdrpman.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpman.sys
 tdrpman+0xbb2b2

It makes your disc conditions bad.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800823eb30, fffffa800823ee10, fffff800039dd720}

----- ETW minidump data unavailable-----
Probably caused by : hardware_disk

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800823eb30, Terminating object
Arg3: fffffa800823ee10, Process image file name
Arg4: fffff800039dd720, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----

KERNEL_LOG_FAILING_PROCESS:  <NULL>

PROCESS_OBJECT: fffffa800823eb30

IMAGE_NAME:  hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_RECORD:  fffff88002c12b78 -- (.exr 0xfffff88002c12b78)
ExceptionAddress: 00000000779b4e8f
   ExceptionCode: c0000006 (In-page I/O error)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fefd91d8a8
   Parameter[2]: 00000000c000000e
Inpage operation failed at 000007fefd91d8a8, due to I/O error 00000000c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000007fefd91d8a8

EXCEPTION_PARAMETER3:  00000000c000000e

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

EXCEPTION_STR:  0xc0000006_c000000e

FAULTING_IP: 
+0
00000000`779b4e8f ??              ???

BUGCHECK_STR:  0xF4_IOERR_c000000e

FOLLOWUP_IP: 
+0
000007fe`fd91d8a8 ??              ???

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware_disk

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  X64_0xF4_IOERR_c000000e_IMAGE_hardware_disk

BUCKET_ID:  X64_0xF4_IOERR_c000000e_IMAGE_hardware_disk

Followup: MachineOwner
---------

Will decide the further steps depending on your feedback.

 

[Flattyraccoon]

Oh wow fast response thank you! Yea, I bought Acronis two years ago and haven't used it since :huh:. It appears the service wasn't set to start but I'm assuming a portion of it runs anyway. I will uninstall Acronis now and test my memory. I also updated my system specs and attached a picture of my installed programs if that helps at all.

 

[JMV2009]

Strange: With

Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

I got this result:

Loading Dump File [C:\Users\Johannes\Downloads\SF_24-11-2012\SF_24-11-2012\112312-29047-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17017.amd64fre.win7_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`03668000 PsLoadedModuleList = 0xfffff800`038a4e70
Debug session time: Sat Nov 24 00:05:36.886 2012 (UTC + 1:00)
System Uptime: 2 days 4:53:13.057
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800823eb30, fffffa800823ee10, fffff800039dd720}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800823eb30, Terminating object
Arg3: fffffa800823ee10, Process image file name
Arg4: fffff800039dd720, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----

KERNEL_LOG_FAILING_PROCESS:  <NULL>

PROCESS_OBJECT: fffffa800823eb30

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  ¿ 

BUGCHECK_STR:  0xF4_¿ 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88002c12b78 -- (.exr 0xfffff88002c12b78)
ExceptionAddress: 00000000779b4e8f
   ExceptionCode: c0000006 (In-page I/O error)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fefd91d8a8
   Parameter[2]: 00000000c000000e
Inpage operation failed at 000007fefd91d8a8, due to I/O error 00000000c000000e

LAST_CONTROL_TRANSFER:  from fffff80003a63a52 to fffff800036d8040

STACK_TEXT:  
fffff880`02c120f8 fffff800`03a63a52 : 00000000`000000f4 00000000`00000003 fffffa80`0823eb30 fffffa80`0823ee10 : nt!KeBugCheckEx
fffff880`02c12100 fffff800`03a0bff3 : ffffffff`ffffffff fffffa80`095078f0 fffffa80`0823eb30 fffffa80`0823eb30 : nt!PspCatchCriticalBreak+0x92
fffff880`02c12140 fffff800`03990dcc : ffffffff`ffffffff 00000000`00000001 fffffa80`0823eb30 fffff6fb`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17326
fffff880`02c12190 fffff800`036d7293 : fffffa80`0823eb30 fffff800`c0000006 ffffe3cd`c8cad870 fffffa80`095078f0 : nt!NtTerminateProcess+0x20c
fffff880`02c12210 fffff800`036d3830 : fffff800`037121cc fffff880`02c12b78 fffff880`02c128e0 fffff880`02c12c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02c123a8 fffff800`037121cc : fffff880`02c12b78 fffff880`02c128e0 fffff880`02c12c20 00000000`02331830 : nt!KiServiceLinkage
fffff880`02c123b0 fffff800`036d7682 : fffff880`02c12b78 00000000`000119c4 fffff880`02c12c20 00000000`02331308 : nt!KiDispatchException+0x53b
fffff880`02c12a40 fffff800`036d61fa : 00000000`00000000 00000000`000119c4 00000000`77aa9d01 00000000`779cf638 : nt!KiExceptionDispatch+0xc2
fffff880`02c12c20 00000000`779b4e8f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`02331250 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779b4e8f


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4____IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4____IMAGE_csrss.exe

Followup: MachineOwner
---------

 

[Arc]

You need not to test memory right now.

After uninstalling Acronis, upload a screenshot of CrystalDiscInfo window.

 

[Flattyraccoon]

Eh too late, I just finished running one pass without errors through memtest86. If memory is the last resort later on I can do the stress test. Acronis is removed now as well, and here is a screenshot of CrystalDiscInfo. I left the computer on to finish a download should I post a screenshot for the hard drive it was saving to as well?

 

[Arc]

Now wait and see if the BSOD occurs again or not.
If it occurs again, let us know with the crash dump.

IMO you need not to do memtest, but if you feel, you may proceed.

 

[Britton30]

I see you have to AV's installed, Avira and Comodo, uninstall one of them and use only one AV at anytime, they can cause BSODs. Get rid of Spybot too, it and w7 don't work well together at all.

 

[Flattyraccoon]

I only have Comodo Firewall installed and made sure the antivirus was not included. That shouldn't cause a problem am I right? I disabled the Windows firewall as well.

 

[Britton30]

Perhaps not but I would use only one firewall too, that's why most security suites disable the w7 one.

 

[Flattyraccoon]

Okay so this time I was actually here to witness it. Before the system went to BSOD Peerblock gave a crash error about "Peerblock experienced an unknown exception" or something of that nature. I couldn't screenshot in time since programs stopped responding. I was using uTorrent at the time. I have a hunch it has to do with these two or mainly Peerblock since it is what gave the error before BSOD. The BSOD error codes were slightly different and I have included another bug diagnostic zip as well as the Peerblock log file if that helps? Thanks!

 

[Arc]

Do some disc checks.

1. Update your SSD's Firmware (skip it, if it is not a SSD)
2. Reseat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Let us know the results.

 

[Britton30]

What is Peer Block? There is this line it its log.

[11/24/2012] [21:01:28.980] [02684]  [Loading_DlgProc]    msg: [COLOR=red]WM_DESTROY[/COLOR].

 

[Flattyraccoon]

Alright I have checked the disks and all came back healthy. None are SDD, I also ran memtest86 for 2 passes and no problems. I finally went through with the final resort and did a fresh install of Windows. This time I went back to my old mentality of minimalism. The old install was over a year old and I had installed/uninstalled a ton of stuff so it felt messy. Anyway I had another BSOD while idling with music just now. The only constant with before is that I had Peerblock and uTorrent running. I have included another diagnostic zip and a new screenshot of my program files. The Comodo install is ONLY the firewall like before. Windows firewall is disabled. Avira antivirus is ONLY the antivirus and Windows Defender is disabled as well. I am leaning towards either faulty hardware (the system is almost 5 years old so it is possible), either the combination of uTorrent and Peerblock (or just one of them), or god forbid someone hacking my computer while I'm torrenting. If you can see anything in particular in the diagnostic zip please let me know. I am going to test the computer by leaving it on for a week without utorrent to see if that is the cause. If not then I will leave it on for another week without Peerblock. Then finally a week without either. Thanks for putting your time into this case as well!

 

[Arc]

OK, you uninstall PerfectDisc Professional and uninstall Marvell controllers, too.

 

[Flattyraccoon]

I don't see the benefit to removing motherboard drivers and perfectdisk shouldn't cause problems like that. Anyway it BSOD'd again and uTorrent wasn't running. Now it says install is corrupt so I'm assuming the hdd isn't healthy life it said or I have a sneaky virus. Gonna install Linux and virus scan all drives. Thanks for your help earlier.

 

[Arc]

No Sneaky virus is there. Some might be there, and they are not causing the crashes for sure. As a check, scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

The problem is, as it may be described, you have installed some weak disc controller, and some unwanted program to monitor the disc. Remove those. If theyy dont work, dont listen to any more of my words.

OK, you uninstall PerfectDisc Professional and uninstall Marvell controllers, too.